Review Questions Chapter 4: Server Monitoring and Auditing

1. You can set filters in Event Viewer for multiple logs. True or False?

2. You can save event log information as a file in which format? (Choose all that apply.) A) Event log file format B) Log file format C) Tab delimited D) Comma delimited

3. Which subtype of the Applications and Services logs in Event Viewer is hidden and disabled by default? (Choose all that apply.) A) Analytic B) Admin C) Debug D) Operational

4. Which of the following logs in Event Viewer do you use to create an event subscription? A) System B) Forwarded Events C) Security D) Setup

5. In the Performance tab of Task Manager, which of the following components can you monitor? (Choose all that apply.) A) CPU use B) Process use C) Memory use D) Network adapters

6. In addition to monitoring system resources, you can do which of the following with Resource Monitor? (Choose all that apply.) A) Review and close processes that have stopped responding. B) Delete files. C) Control services. D) See what files are in use by applications.

7. Which of the following is a source of data for Performance Monitor? (Choose all that apply.) A) Configuration information B) Event trace data C) Task Manager data D) Performance counters

8. Performance Monitor displays statistics in which of the following formats? (Choose all that apply.) A) Pie chart B) Histogram C) Report D) Line graph

9. What should you do to get a better idea of normal and abnormal system performance on your network? A) Talk to your users every day. B) Create a baseline by recording monitor sessions at random times for later comparison. C) Watch for certain thresholds to be exceeded. D) Create a baseline by recording monitor sessions at peak and off-peak times for later comparison.

10. An alert in Performance Monitor can write an event to which log? A) Security B) System C) Application D) Error

11. When can thresholds in a data collector set be configured to trigger an alert? (Choose all that apply.) A) The value in the counter falls below the threshold. B) The value in the counter is equal to the threshold. C) The value in the counter rises above the threshold. D) The value in the counter differs from the threshold by some percentage up or down.

12. Protocol analyzers provide information on which of the following? (Choose all that apply.) A) Network throughput B) Network speed C) Protocols in use on the network D) Contents of network packets

13. The Users group has permission to do which of the following in Performance Monitor? (Choose all that apply.) A) View log files B) Access real-time data C) Create data collector sets D) Modify display properties

14. Performance-monitoring tools cant be used for network monitoring. True or False?

15. An object must have an associated SACL to be audited. True or False?

16. Advanced auditing policies cant be overridden by broader basic policies. True or False?

17. Global object access auditing allows you to do which of the following? A) Audit computers outside your domain. B) Audit computers over a WAN. C) Increase the number of objects that can be audited. D) Configure a single policy to audit access to all folders and files on a disk.

18. You can use auditpol to handle which of the following auditing tasks? (Choose all that apply.) A) Back up and restore audit policies to CSV files. B) Disable advanced auditing policies to return to basic policies. C) Display current audit policies. D) Configure global resource SACLs.

BOOK: MCSA Guide to Administering Microsoft Windows Server 2012/R2 (1st edition) AUTHOR: Greg Tomsho ISBN: 128586834X ISBN-13: 9781285868349